deploy(witness): fixes from bringing network.auths.dev up on Fly#400
Merged
Conversation
Three fixes from the first live deploy: - fly.toml: flyctl resolves [build] dockerfile relative to the CONFIG file's dir, not the build context — so 'deploy/witness/Dockerfile' doubled into a not-found path. Use '../Dockerfile'. - Dockerfile: run as root. The node's data dir IS the mounted volume (anchor store + registry), and a freshly attached volume mounts root-owned on fly / compose / k8s — a non-root process cannot create its state there, so it exited on boot. The VM/container is the isolation boundary. - .dockerignore: drop tests/ .recurve/ .chunkhound/ site/ from the build context (~940 MB -> a fraction), so uploads/builds aren't needlessly slow. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Auths-Scope: sign_commit Auths-Id: did:keri:EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd Auths-Device: did:keri:EO1cBsYoV5izKvdIL6TstN5TOQl1hYN3WnhtAOh1lwAp Auths-Anchor-Seq: 13
Auths Commit Verification
Result: ✅ 1/1 commits verified |
Two more fixes from the live bring-up of network.auths.dev, both about a witness that has no members yet: - git2 owner validation off. libgit2 refuses a repo dir owned by a different user (CVE-2022-24765 'dubious ownership'); in a single-tenant container the volume's owner legitimately differs from the process, so opt out at startup — the container/VM is the boundary (as `safe.directory = *` does for git CLI). - the registry (serve) role no longer requires a POPULATED registry. It only needs an initialized repo (ensure_registry) + the git binary, and serves an empty refs/auths/* happily. The anchor role keeps its fail-closed 'no synced registry' discipline (RT-2) — so the fly bootstrap runs kel,cosign,registry and adds anchor once members exist. Verified live: https://auths-network.fly.dev/health is ok and `git ls-remote https://auths-network.fly.dev` succeeds. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Auths-Scope: sign_commit Auths-Id: did:keri:EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd Auths-Device: did:keri:EO1cBsYoV5izKvdIL6TstN5TOQl1hYN3WnhtAOh1lwAp Auths-Anchor-Seq: 13
Auths Commit Verification
Result: ✅ 2/2 commits verified |
Captures the hard-won learnings so a contributor (or an LLM) can fix the same issues fast: the diagnostic recipe for a fast-crashing machine (Fly swallows the stderr — ssh a one-off with the volume and run the command under `timeout`), plus a symptom -> cause -> fix table for the dockerfile-path resolution, build context bloat, libgit2 dubious-ownership, root-owned volume, and the anchor role's empty-registry fail-closed. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Auths-Scope: sign_commit Auths-Id: did:keri:EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd Auths-Device: did:keri:EO1cBsYoV5izKvdIL6TstN5TOQl1hYN3WnhtAOh1lwAp Auths-Anchor-Seq: 13
Auths Commit Verification
Result: ✅ 3/3 commits verified |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Three fixes surfaced by the first live Fly deploy of
network.auths.dev:[build] dockerfilerelative to the config file's dir, not the build context, sodeploy/witness/Dockerfiledoubled into a not-found path. Now../Dockerfile.witnessuser couldn't create its state and the machine exited on boot. The VM/container is the isolation boundary.tests/.recurve/.chunkhound/site/(build context ~940 MB → a fraction).Follow-up to #399.
🤖 Generated with Claude Code